Vulnerabilities > CVE-2019-1010268 - XXE vulnerability in Ladon Project Ladon

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

ladon-project

CWE-611

critical

NVD

Published: 2019-07-18

Updated: 2019-07-24

Summary

Ladon since 0.6.1 (since ebef0aae48af78c159b6fce81bc6f5e7e0ddb059) is affected by: XML External Entity (XXE). The impact is: Information Disclosure, reading files and reaching internal network endpoints. The component is: SOAP request handlers. For instance: https://bitbucket.org/jakobsg/ladon/src/42944fc012a3a48214791c120ee5619434505067/src/ladon/interfaces/soap.py#lines-688. The attack vector is: Send a specially crafted SOAP call.

Vulnerable Configurations

Part	Description	Count
Application	Ladon_Project Ladon Project Ladon 0.6.1 Ladon Project Ladon 0.6.2 Ladon Project Ladon 0.6.3 Ladon Project Ladon 0.6.4 Ladon Project Ladon 0.6.5 Ladon Project Ladon 0.6.6 Ladon Project Ladon 0.6.7 Ladon Project Ladon 0.7.0 Ladon Project Ladon 0.7.1 Ladon Project Ladon 0.7.2 Ladon Project Ladon 0.7.3 Ladon Project Ladon 0.7.6 Ladon Project Ladon 0.7.7 Ladon Project Ladon 0.7.9 Ladon Project Ladon 0.8.0 Ladon Project Ladon 0.8.1 Ladon Project Ladon 0.8.2 Ladon Project Ladon 0.8.3 Ladon Project Ladon 0.8.4 Ladon Project Ladon 0.8.5 Ladon Project Ladon 0.8.6 Ladon Project Ladon 0.8.7 Ladon Project Ladon 0.8.8 Ladon Project Ladon 0.8.9 Ladon Project Ladon 0.9.0 Ladon Project Ladon 0.9.1 Ladon Project Ladon 0.9.3 Ladon Project Ladon 0.9.8 Ladon Project Ladon 0.9.9 Ladon Project Ladon 0.9.10 Ladon Project Ladon 0.9.11 Ladon Project Ladon 0.9.12 Ladon Project Ladon 0.9.13 Ladon Project Ladon 0.9.15 Ladon Project Ladon 0.9.16 Ladon Project Ladon 0.9.17 Ladon Project Ladon 0.9.18 Ladon Project Ladon 0.9.19 Ladon Project Ladon 0.9.20 Ladon Project Ladon 0.9.21 Ladon Project Ladon 0.9.22 Ladon Project Ladon 0.9.23 Ladon Project Ladon 0.9.24 Ladon Project Ladon 0.9.26 Ladon Project Ladon 0.9.27 Ladon Project Ladon 0.9.28 Ladon Project Ladon 0.9.29 Ladon Project Ladon 0.9.30 Ladon Project Ladon 0.9.31 Ladon Project Ladon 0.9.32 Ladon Project Ladon 0.9.33 Ladon Project Ladon 0.9.34 Ladon Project Ladon 0.9.35 Ladon Project Ladon 0.9.36 Ladon Project Ladon 0.9.37 Ladon Project Ladon 0.9.38 Ladon Project Ladon 0.9.39 Ladon Project Ladon 0.9.40	58

Common Weakness Enumeration (CWE)

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References